How to handle the authentication between microservices when the application originates the call

user_6749805 0
Viewed 1873

I was reading a lot regarding authentication in a microservices architecture, and I end up with the conclusion that JWS security is the way to go. That means

  • When the client makes a request, it needs to have a valid access token
  • The authentication of the requests is happening at the gateway level, the authorization at the microservice application level
  • When the client makes a request to microservice A, and I need to call microservice B, I need to re-use the same access token to make the requests to A and B.

But I still have a lot of doubts when the originator of the request is not a client, and it's another application, from outside the microservice architecture and from inside

  • If we have a monolithic application and we want to call a microservice, we are planning to develop a light way authentication model with an API-Key that is going to be translated to a JWS at the gateway level. So the application doesn't need to maintain a session (with tokens and refresh tokens) and can make requests just using an API-Key, but at the gateway level that API-Key would be translated into a JWS, so everything inside the microservices architecture would be using JWS as the authorization model.

  • But what if we want to communicate the microservice A with microservice B, and the one that originates the call is microservice A. That means application to application in the same microservices architecture. Here are my doubts:

  1. If I follow the same logic explained above, I would need to pass through the gateway to translate the API-Key to a JWS just to communicate two microservices and it doesn't make sense.
  2. The communication between microservices inside the same architecture, needs to be authenticated/authorized? We are using Istio for mutual TLS
  3. It's the API-Key a good idea for app-to-app authentication? Or it's just better to use JWS for everything?
  4. If the way to go is another totally different authentication/authorization model. Does that mean that the applications need to support both models? (That would increase the complexity of all the microservices)

This topic confuses me, so any help regarding this subject is more than welcome

microservices jwt spring-boot security
1 Answers

Have you considered using client credentials flow? It looks like it should be sufficient for your monolithic app to call the microservices. It's an OAuth flow designed for app-to-app communication. Your monolithic app will be able to obtain a JWS access token easily, with one request to the Authorization Server.

Personally, I wouldn't go with API keys, but use client credentials flow instead. It's standard-based so you wouldn't have to reinvent the wheel.

  1. The communication between microservices inside the same architecture, needs to be authenticated/authorized? We are using Istio for mutual TLS

If you're using Istio with mTLS, then the communication is already authenticated. If I recall correctly, you can also define some authorization rules in Istio (which service is allowed to call which service, etc.). If your monolithic app is in the same network, then you can use that to authenticate it, and you won't need the client credentials flow at all.

user_17122940
Related